Skip to content


Browse files Browse the repository at this point in the history
feat: add npm audit signatures (#4827)
* feat: add npm audit signatures

Implements [RFC: Improve signature verification](npm/rfcs#550)

Adds a new sub-command to `audit`: `npm audit signatures` (following [`npm audit licenses`](#3452))

This command will verify registry signatures stored in the packument against a public key on the registry.

- Any registry that implements `host/-/npm/v1/keys` endpoint and provides `signatures` in the packument `dist` object
- Validates public keys are not expired
- Errors when encountering packages with missing signatures when the registry returns keys at `host/-/npm/v1/keys`
- Errors when encountering invalid signatures
- Output: json/human formats
  • Loading branch information
feelepxyz committed Jul 11, 2022
1 parent ef8d2ed commit f032e1c
Show file tree
Hide file tree
Showing 8 changed files with 2,086 additions and 13 deletions.
13 changes: 12 additions & 1 deletion docs/content/commands/
Expand Up @@ -11,7 +11,7 @@ description: Run a security audit
<!-- see lib/commands/audit.js -->

npm audit [fix]
npm audit [fix|signatures]

<!-- automatically generated, do not edit manually -->
Expand Down Expand Up @@ -41,6 +41,17 @@ vulnerability is found. It may be useful in CI environments to include the
will cause the command to fail. This option does not filter the report
output, it simply changes the command's failure threshold.

### Audit Signatures

This command can also audit the integrity values of the packages in your
tree against any signatures present in the registry they were downloaded
from. npm will attempt to download the keys from `/-/npm/v1/keys` on
each the registry used to download any given package. It will then
check the `dist.signatures` object in the package itself, and verify the
`sig` present there using the `keyid` there, matching it with a key
returned from the registry. The command for this is `npm audit

### Audit Endpoints

There are two audit endpoints that npm may use to fetch vulnerability
Expand Down

0 comments on commit f032e1c

Please sign in to comment.